net/ipv4/netfilter/arptable_filter.c

   1 /*
   2  * Filtering ARP tables module.
   3  *
   4  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
   5  *
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/netfilter_arp/arp_tables.h>
  10
  11 MODULE_LICENSE("GPL");
  12 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
  13 MODULE_DESCRIPTION("arptables filter table");
  14
  15 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
  16                            (1 << NF_ARP_FORWARD))
  17
  18 /* Standard entry. */
  19 struct arpt_standard
  20 {
  21         struct arpt_entry entry;
  22         struct arpt_standard_target target;
  23 };
  24
  25 struct arpt_error_target
  26 {
  27         struct arpt_entry_target target;
  28         char errorname[ARPT_FUNCTION_MAXNAMELEN];
  29 };
  30
  31 struct arpt_error
  32 {
  33         struct arpt_entry entry;
  34         struct arpt_error_target target;
  35 };
  36
  37 static struct
  38 {
  39         struct arpt_replace repl;
  40         struct arpt_standard entries[3];
  41         struct arpt_error term;
  42 } initial_table __initdata
  43 = { { "filter", FILTER_VALID_HOOKS, 4,
  44       sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
  45       { [NF_ARP_IN] = 0,
  46         [NF_ARP_OUT] = sizeof(struct arpt_standard),
  47         [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard), },
  48       { [NF_ARP_IN] = 0,
  49         [NF_ARP_OUT] = sizeof(struct arpt_standard),
  50         [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard), },
  51       0, NULL, { } },
  52     {
  53             /* ARP_IN */
  54             {
  55                     {
  56                             {
  57                                     { 0 }, { 0 }, { 0 }, { 0 },
  58                                     0, 0,
  59                                     { { 0, }, { 0, } },
  60                                     { { 0, }, { 0, } },
  61                                     0, 0,
  62                                     0, 0,
  63                                     0, 0,
  64                                     "", "", { 0 }, { 0 },
  65                                     0, 0
  66                             },
  67                             sizeof(struct arpt_entry),
  68                             sizeof(struct arpt_standard),
  69                             0,
  70                             { 0, 0 }, { } },
  71                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
  72                       -NF_ACCEPT - 1 }
  73             },
  74             /* ARP_OUT */
  75             {
  76                     {
  77                             {
  78                                     { 0 }, { 0 }, { 0 }, { 0 },
  79                                     0, 0,
  80                                     { { 0, }, { 0, } },
  81                                     { { 0, }, { 0, } },
  82                                     0, 0,
  83                                     0, 0,
  84                                     0, 0,
  85                                     "", "", { 0 }, { 0 },
  86                                     0, 0
  87                             },
  88                             sizeof(struct arpt_entry),
  89                             sizeof(struct arpt_standard),
  90                             0,
  91                             { 0, 0 }, { } },
  92                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
  93                       -NF_ACCEPT - 1 }
  94             },
  95             /* ARP_FORWARD */
  96             {
  97                     {
  98                             {
  99                                     { 0 }, { 0 }, { 0 }, { 0 },
 100                                     0, 0,
 101                                     { { 0, }, { 0, } },
 102                                     { { 0, }, { 0, } },
 103                                     0, 0,
 104                                     0, 0,
 105                                     0, 0,
 106                                     "", "", { 0 }, { 0 },
 107                                     0, 0
 108                             },
 109                             sizeof(struct arpt_entry),
 110                             sizeof(struct arpt_standard),
 111                             0,
 112                             { 0, 0 }, { } },
 113                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
 114                       -NF_ACCEPT - 1 }
 115             }
 116     },
 117     /* ERROR */
 118     {
 119             {
 120                     {
 121                             { 0 }, { 0 }, { 0 }, { 0 },
 122                             0, 0,
 123                             { { 0, }, { 0, } },
 124                             { { 0, }, { 0, } },
 125                             0, 0,
 126                             0, 0,
 127                             0, 0,
 128                             "", "", { 0 }, { 0 },
 129                             0, 0
 130                     },
 131                     sizeof(struct arpt_entry),
 132                     sizeof(struct arpt_error),
 133                     0,
 134                     { 0, 0 }, { } },
 135             { { { { ARPT_ALIGN(sizeof(struct arpt_error_target)), ARPT_ERROR_TARGET } },
 136                 { } },
 137               "ERROR"
 138             }
 139     }
 140 };
 141
 142 static struct arpt_table packet_filter = {
 143         .name           = "filter",
 144         .valid_hooks    = FILTER_VALID_HOOKS,
 145         .lock           = RW_LOCK_UNLOCKED,
 146         .private        = NULL,
 147         .me             = THIS_MODULE,
 148         .af             = NF_ARP,
 149 };
 150
 151 /* The work comes in here from netfilter.c */
 152 static unsigned int arpt_hook(unsigned int hook,
 153                               struct sk_buff **pskb,
 154                               const struct net_device *in,
 155                               const struct net_device *out,
 156                               int (*okfn)(struct sk_buff *))
 157 {
 158         return arpt_do_table(pskb, hook, in, out, &packet_filter, NULL);
 159 }
 160
 161 static struct nf_hook_ops arpt_ops[] = {
 162         {
 163                 .hook           = arpt_hook,
 164                 .owner          = THIS_MODULE,
 165                 .pf             = NF_ARP,
 166                 .hooknum        = NF_ARP_IN,
 167         },
 168         {
 169                 .hook           = arpt_hook,
 170                 .owner          = THIS_MODULE,
 171                 .pf             = NF_ARP,
 172                 .hooknum        = NF_ARP_OUT,
 173         },
 174         {
 175                 .hook           = arpt_hook,
 176                 .owner          = THIS_MODULE,
 177                 .pf             = NF_ARP,
 178                 .hooknum        = NF_ARP_FORWARD,
 179         },
 180 };
 181
 182 static int __init init(void)
 183 {
 184         int ret, i;
 185
 186         /* Register table */
 187         ret = arpt_register_table(&packet_filter, &initial_table.repl);
 188         if (ret < 0)
 189                 return ret;
 190
 191         for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
 192                 if ((ret = nf_register_hook(&arpt_ops[i])) < 0)
 193                         goto cleanup_hooks;
 194         return ret;
 195
 196 cleanup_hooks:
 197         while (--i >= 0)
 198                 nf_unregister_hook(&arpt_ops[i]);
 199
 200         arpt_unregister_table(&packet_filter);
 201         return ret;
 202 }
 203
 204 static void __exit fini(void)
 205 {
 206         unsigned int i;
 207
 208         for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
 209                 nf_unregister_hook(&arpt_ops[i]);
 210
 211         arpt_unregister_table(&packet_filter);
 212 }
 213
 214 module_init(init);
 215 module_exit(fini);